pwnlib.shellcraft.i386 — Shellcode for Intel 80386

pwnlib.shellcraft.i386

Shellcraft module containing generic Intel i386 shellcodes.

pwnlib.shellcraft.i386.breakpoint()[source]

A single-byte breakpoint instruction.

pwnlib.shellcraft.i386.crash()[source]

Crash.

Example

>>> run_assembly(shellcraft.crash()).poll(True)
-11
pwnlib.shellcraft.i386.epilog(nargs=0)[source]

Function epilogue.

Parameters:nargs (int) – Number of arguments to pop off the stack.
pwnlib.shellcraft.i386.function(name, template_function, *registers)[source]

Converts a shellcraft template into a callable function.

Parameters:
  • template_sz (callable) – Rendered shellcode template. Any variable Arguments should be supplied as registers.
  • name (str) – Name of the function.
  • registers (list) – List of registers which should be filled from the stack.
>>> shellcode = ''
>>> shellcode += shellcraft.function('write', shellcraft.i386.linux.write, )

>>> hello = shellcraft.i386.linux.echo("Hello!", 'eax')
>>> hello_fn = shellcraft.i386.function(hello, 'eax').strip()
>>> exit = shellcraft.i386.linux.exit('edi')
>>> exit_fn = shellcraft.i386.function(exit, 'edi').strip()
>>> shellcode = '''
...     push STDOUT_FILENO
...     call hello
...     push 33
...     call exit
... hello:
...     %(hello_fn)s
... exit:
...     %(exit_fn)s
... ''' % (locals())
>>> p = run_assembly(shellcode)
>>> p.recvall()
'Hello!'
>>> p.wait_for_close()
>>> p.poll()
33

Notes

Can only be used on a shellcraft template which takes all of its arguments as registers. For example, the pushstr

pwnlib.shellcraft.i386.getpc(register='ecx')[source]

Retrieves the value of EIP, stores it in the desired register.

Parameters:return_value – Value to return
pwnlib.shellcraft.i386.infloop()[source]

A two-byte infinite loop.

pwnlib.shellcraft.i386.itoa(v, buffer='esp', allocate_stack=True)[source]

Converts an integer into its string representation, and pushes it onto the stack.

Parameters:
  • v (str, int) – Integer constant or register that contains the value to convert.
  • alloca

Example

>>> sc = shellcraft.i386.mov('eax', 0xdeadbeef)
>>> sc += shellcraft.i386.itoa('eax')
>>> sc += shellcraft.i386.linux.write(1, 'esp', 32)
>>> run_assembly(sc).recvuntil('\x00')
'3735928559\x00'
pwnlib.shellcraft.i386.memcpy(dest, src, n)[source]

Copies memory.

Parameters:
  • dest – Destination address
  • src – Source address
  • n – Number of bytes
pwnlib.shellcraft.i386.mov(dest, src, stack_allowed=True)[source]

Move src into dest without newlines and null bytes.

If the src is a register smaller than the dest, then it will be zero-extended to fit inside the larger register.

If the src is a register larger than the dest, then only some of the bits will be used.

If src is a string that is not a register, then it will locally set context.arch to ‘i386’ and use pwnlib.constants.eval() to evaluate the string. Note that this means that this shellcode can change behavior depending on the value of context.os.

Parameters:
  • dest (str) – The destination register.
  • src (str) – Either the input register, or an immediate value.
  • stack_allowed (bool) – Can the stack be used?

Example

>>> print shellcraft.i386.mov('eax','ebx').rstrip()
    mov eax, ebx
>>> print shellcraft.i386.mov('eax', 0).rstrip()
    xor eax, eax
>>> print shellcraft.i386.mov('ax', 0).rstrip()
    xor ax, ax
>>> print shellcraft.i386.mov('ax', 17).rstrip()
    xor ax, ax
    mov al, 0x11
>>> print shellcraft.i386.mov('edi', ord('\n')).rstrip()
    push 9 /* mov edi, '\n' */
    pop edi
    inc edi
>>> print shellcraft.i386.mov('al', 'ax').rstrip()
    /* moving ax into al, but this is a no-op */
>>> print shellcraft.i386.mov('al','ax').rstrip()
    /* moving ax into al, but this is a no-op */
>>> print shellcraft.i386.mov('esp', 'esp').rstrip()
    /* moving esp into esp, but this is a no-op */
>>> print shellcraft.i386.mov('ax', 'bl').rstrip()
    movzx ax, bl
>>> print shellcraft.i386.mov('eax', 1).rstrip()
    push 1
    pop eax
>>> print shellcraft.i386.mov('eax', 1, stack_allowed=False).rstrip()
    xor eax, eax
    mov al, 1
>>> print shellcraft.i386.mov('eax', 0xdead00ff).rstrip()
    mov eax, -0xdead00ff
    neg eax
>>> print shellcraft.i386.mov('eax', 0xc0).rstrip()
    xor eax, eax
    mov al, 0xc0
>>> print shellcraft.i386.mov('edi', 0xc0).rstrip()
    mov edi, -0xc0
    neg edi
>>> print shellcraft.i386.mov('eax', 0xc000).rstrip()
    xor eax, eax
    mov ah, 0xc000 >> 8
>>> print shellcraft.i386.mov('eax', 0xffc000).rstrip()
    mov eax, 0x1010101
    xor eax, 0x1010101 ^ 0xffc000
>>> print shellcraft.i386.mov('edi', 0xc000).rstrip()
    mov edi, (-1) ^ 0xc000
    not edi
>>> print shellcraft.i386.mov('edi', 0xf500).rstrip()
    mov edi, 0x1010101
    xor edi, 0x1010101 ^ 0xf500
>>> print shellcraft.i386.mov('eax', 0xc0c0).rstrip()
    xor eax, eax
    mov ax, 0xc0c0
>>> print shellcraft.i386.mov('eax', 'SYS_execve').rstrip()
    push (SYS_execve) /* 0xb */
    pop eax
>>> with context.local(os='freebsd'):
...     print shellcraft.i386.mov('eax', 'SYS_execve').rstrip()
    push (SYS_execve) /* 0x3b */
    pop eax
>>> print shellcraft.i386.mov('eax', 'PROT_READ | PROT_WRITE | PROT_EXEC').rstrip()
    push (PROT_READ | PROT_WRITE | PROT_EXEC) /* 7 */
    pop eax
pwnlib.shellcraft.i386.nop()[source]

A single-byte nop instruction.

pwnlib.shellcraft.i386.prolog()[source]

Function prologue.

pwnlib.shellcraft.i386.push(value)[source]

Pushes a value onto the stack without using null bytes or newline characters.

If src is a string, then we try to evaluate with context.arch = ‘i386’ using pwnlib.constants.eval() before determining how to push it. Note that this means that this shellcode can change behavior depending on the value of context.os.

Parameters:value (int,str) – The value or register to push

Example

>>> print pwnlib.shellcraft.i386.push(0).rstrip()
    /* push 0 */
    push 1
    dec byte ptr [esp]
>>> print pwnlib.shellcraft.i386.push(1).rstrip()
    /* push 1 */
    push 1
>>> print pwnlib.shellcraft.i386.push(256).rstrip()
    /* push 0x100 */
    push 0x1010201
    xor dword ptr [esp], 0x1010301
>>> print pwnlib.shellcraft.i386.push('SYS_execve').rstrip()
    /* push (SYS_execve) (0xb) */
    push 0xb
>>> print pwnlib.shellcraft.i386.push('SYS_sendfile').rstrip()
    /* push (SYS_sendfile) (0xbb) */
    push 0x1010101
    xor dword ptr [esp], 0x10101ba
>>> with context.local(os = 'freebsd'):
...     print pwnlib.shellcraft.i386.push('SYS_execve').rstrip()
    /* push (SYS_execve) (0x3b) */
    push 0x3b
pwnlib.shellcraft.i386.pushstr(string, append_null=True)[source]

Pushes a string onto the stack without using null bytes or newline characters.

Example

>>> print shellcraft.i386.pushstr('').rstrip()
    /* push '\x00' */
    push 1
    dec byte ptr [esp]
>>> print shellcraft.i386.pushstr('a').rstrip()
    /* push 'a\x00' */
    push 0x61
>>> print shellcraft.i386.pushstr('aa').rstrip()
    /* push 'aa\x00' */
    push 0x1010101
    xor dword ptr [esp], 0x1016060
>>> print shellcraft.i386.pushstr('aaa').rstrip()
    /* push 'aaa\x00' */
    push 0x1010101
    xor dword ptr [esp], 0x1606060
>>> print shellcraft.i386.pushstr('aaaa').rstrip()
    /* push 'aaaa\x00' */
    push 1
    dec byte ptr [esp]
    push 0x61616161
>>> print shellcraft.i386.pushstr('aaaaa').rstrip()
    /* push 'aaaaa\x00' */
    push 0x61
    push 0x61616161
>>> print shellcraft.i386.pushstr('aaaa', append_null = False).rstrip()
    /* push 'aaaa' */
    push 0x61616161
>>> print shellcraft.i386.pushstr('\xc3').rstrip()
    /* push '\xc3\x00' */
    push 0x1010101
    xor dword ptr [esp], 0x10101c2
>>> print shellcraft.i386.pushstr('\xc3', append_null = False).rstrip()
    /* push '\xc3' */
    push -0x3d
>>> with context.local():
...    context.arch = 'i386'
...    print enhex(asm(shellcraft.pushstr("/bin/sh")))
68010101018134242e726901682f62696e
>>> with context.local():
...    context.arch = 'i386'
...    print enhex(asm(shellcraft.pushstr("")))
6a01fe0c24
>>> with context.local():
...    context.arch = 'i386'
...    print enhex(asm(shellcraft.pushstr("\x00", False)))
6a01fe0c24
Parameters:
  • string (str) – The string to push.
  • append_null (bool) – Whether to append a single NULL-byte before pushing.
pwnlib.shellcraft.i386.pushstr_array(reg, array)[source]

Pushes an array/envp-style array of pointers onto the stack.

Parameters:
  • reg (str) – Destination register to hold the pointer.
  • array (str,list) – Single argument or list of arguments to push. NULL termination is normalized so that each argument ends with exactly one NULL byte.
pwnlib.shellcraft.i386.ret(return_value=None)[source]

A single-byte RET instruction.

Parameters:return_value – Value to return
pwnlib.shellcraft.i386.setregs(reg_context, stack_allowed=True)[source]

Sets multiple registers, taking any register dependencies into account (i.e., given eax=1,ebx=eax, set ebx first).

Parameters:
  • reg_context (dict) – Desired register context
  • stack_allowed (bool) – Can the stack be used?

Example

>>> print shellcraft.setregs({'eax':1, 'ebx':'eax'}).rstrip()
    mov ebx, eax
    push 1
    pop eax
>>> print shellcraft.setregs({'eax':'ebx', 'ebx':'eax', 'ecx':'ebx'}).rstrip()
    mov ecx, ebx
    xchg eax, ebx
pwnlib.shellcraft.i386.stackarg(index, register)[source]

Loads a stack-based argument into a register.

Assumes that the ‘prolog’ code was used to save EBP.

Parameters:
  • index (int) – Zero-based argument index.
  • register (str) – Register name.
pwnlib.shellcraft.i386.stackhunter(cookie = 0x7afceb58)[source]

Returns an an egghunter, which searches from esp and upwards for a cookie. However to save bytes, it only looks at a single 4-byte alignment. Use the function stackhunter_helper to generate a suitable cookie prefix for you.

The default cookie has been chosen, because it makes it possible to shave a single byte, but other cookies can be used too.

Example

>>> with context.local():
...    context.arch = 'i386'
...    print enhex(asm(shellcraft.stackhunter()))
3d58ebfc7a75faffe4
>>> with context.local():
...    context.arch = 'i386'
...    print enhex(asm(shellcraft.stackhunter(0xdeadbeef)))
583defbeadde75f8ffe4
pwnlib.shellcraft.i386.strcpy(dst, src)[source]

Copies a string

Example

>>> sc  = 'jmp get_str\n'
>>> sc += 'pop_str: pop eax\n'
>>> sc += shellcraft.i386.strcpy('esp', 'eax')
>>> sc += shellcraft.i386.linux.write(1, 'esp', 32)
>>> sc += shellcraft.i386.linux.exit(0)
>>> sc += 'get_str: call pop_str\n'
>>> sc += '.asciz "Hello, world\\n"'
>>> run_assembly(sc).recvline()
'Hello, world\n'
pwnlib.shellcraft.i386.strlen(string, reg='ecx')[source]

Calculate the length of the specified string.

Parameters:
  • string (str) – Register or address with the string
  • reg (str) – Named register to return the value in, ecx is the default.

Example

>>> sc  = 'jmp get_str\n'
>>> sc += 'pop_str: pop eax\n'
>>> sc += shellcraft.i386.strlen('eax')
>>> sc += 'push ecx;'
>>> sc += shellcraft.i386.linux.write(1, 'esp', 4)
>>> sc += shellcraft.i386.linux.exit(0)
>>> sc += 'get_str: call pop_str\n'
>>> sc += '.asciz "Hello, world\\n"'
>>> run_assembly(sc).unpack() == len('Hello, world\n')
True
pwnlib.shellcraft.i386.trap()[source]

A trap instruction.

pwnlib.shellcraft.i386.xor(key, address, count)[source]

XORs data a constant value.

Parameters:
  • key (int,str) – XOR key either as a 4-byte integer, If a string, length must be a power of two, and not longer than 4 bytes. Alternately, may be a register.
  • address (int) – Address of the data (e.g. 0xdead0000, ‘esp’)
  • count (int) – Number of bytes to XOR, or a register containing the number of bytes to XOR.

Example

>>> sc  = shellcraft.read(0, 'esp', 32)
>>> sc += shellcraft.xor(0xdeadbeef, 'esp', 32)
>>> sc += shellcraft.write(1, 'esp', 32)
>>> io = run_assembly(sc)
>>> io.send(cyclic(32))
>>> result = io.recvn(32)
>>> expected = xor(cyclic(32), p32(0xdeadbeef))
>>> result == expected
True

pwnlib.shellcraft.i386.linux

Shellcraft module containing Intel i386 shellcodes for Linux.

pwnlib.shellcraft.i386.linux.accept(fd, addr, addr_len)[source]

Invokes the syscall accept. See ‘man 2 accept’ for more information.

Parameters:
  • fd (int) – fd
  • addr (SOCKADDR_ARG) – addr
  • addr_len (socklen_t) – addr_len
pwnlib.shellcraft.i386.linux.acceptloop_ipv4(port)[source]
Parameters:port (int) – the listening port

Waits for a connection. Leaves socket in EBP. ipv4 only

pwnlib.shellcraft.i386.linux.access(name, type)[source]

Invokes the syscall access. See ‘man 2 access’ for more information.

Parameters:
  • name (char) – name
  • type (int) – type
pwnlib.shellcraft.i386.linux.acct(name)[source]

Invokes the syscall acct. See ‘man 2 acct’ for more information.

Parameters:name (char) – name
pwnlib.shellcraft.i386.linux.alarm(seconds)[source]

Invokes the syscall alarm. See ‘man 2 alarm’ for more information.

Parameters:seconds (unsigned) – seconds
pwnlib.shellcraft.i386.linux.bind(fd, addr, length)[source]

Invokes the syscall bind. See ‘man 2 bind’ for more information.

Parameters:
  • fd (int) – fd
  • addr (CONST_SOCKADDR_ARG) – addr
  • len (socklen_t) – len
pwnlib.shellcraft.i386.linux.brk(addr)[source]

Invokes the syscall brk. See ‘man 2 brk’ for more information.

Parameters:addr (void) – addr
pwnlib.shellcraft.i386.linux.cat(filename, fd=1)[source]

Opens a file and writes its contents to the specified file descriptor.

Example

>>> f = tempfile.mktemp()
>>> write(f, 'FLAG')
>>> run_assembly(shellcraft.i386.linux.cat(f)).recvall()
'FLAG'
pwnlib.shellcraft.i386.linux.chdir(path)[source]

Invokes the syscall chdir. See ‘man 2 chdir’ for more information.

Parameters:path (char) – path
pwnlib.shellcraft.i386.linux.chmod(file, mode)[source]

Invokes the syscall chmod. See ‘man 2 chmod’ for more information.

Parameters:
  • file (char) – file
  • mode (mode_t) – mode
pwnlib.shellcraft.i386.linux.chown(file, owner, group)[source]

Invokes the syscall chown. See ‘man 2 chown’ for more information.

Parameters:
  • file (char) – file
  • owner (uid_t) – owner
  • group (gid_t) – group
pwnlib.shellcraft.i386.linux.chroot(path)[source]

Invokes the syscall chroot. See ‘man 2 chroot’ for more information.

Parameters:path (char) – path
pwnlib.shellcraft.i386.linux.clock_getres(clock_id, res)[source]

Invokes the syscall clock_getres. See ‘man 2 clock_getres’ for more information.

Parameters:
  • clock_id (clockid_t) – clock_id
  • res (timespec) – res
pwnlib.shellcraft.i386.linux.clock_gettime(clock_id, tp)[source]

Invokes the syscall clock_gettime. See ‘man 2 clock_gettime’ for more information.

Parameters:
  • clock_id (clockid_t) – clock_id
  • tp (timespec) – tp
pwnlib.shellcraft.i386.linux.clock_nanosleep(clock_id, flags, req, rem)[source]

Invokes the syscall clock_nanosleep. See ‘man 2 clock_nanosleep’ for more information.

Parameters:
  • clock_id (clockid_t) – clock_id
  • flags (int) – flags
  • req (timespec) – req
  • rem (timespec) – rem
pwnlib.shellcraft.i386.linux.clock_settime(clock_id, tp)[source]

Invokes the syscall clock_settime. See ‘man 2 clock_settime’ for more information.

Parameters:
  • clock_id (clockid_t) – clock_id
  • tp (timespec) – tp
pwnlib.shellcraft.i386.linux.clone(fn, child_stack, flags, arg, vararg)[source]

Invokes the syscall clone. See ‘man 2 clone’ for more information.

Parameters:
  • fn (int) – fn
  • child_stack (void) – child_stack
  • flags (int) – flags
  • arg (void) – arg
  • vararg (int) – vararg
pwnlib.shellcraft.i386.linux.close(fd)[source]

Invokes the syscall close. See ‘man 2 close’ for more information.

Parameters:fd (int) – fd
pwnlib.shellcraft.i386.linux.connect(host, port, network='ipv4')[source]

Connects to the host on the specified port. Leaves the connected socket in edx

Parameters:
  • host (str) – Remote IP address or hostname (as a dotted quad / string)
  • port (int) – Remote port
  • network (str) – Network protocol (ipv4 or ipv6)

Examples

>>> l = listen(timeout=5)
>>> assembly  = shellcraft.i386.linux.connect('localhost', l.lport)
>>> assembly += shellcraft.i386.pushstr('Hello')
>>> assembly += shellcraft.i386.linux.write('edx', 'esp', 5)
>>> p = run_assembly(assembly)
>>> l.wait_for_connection().recv()
'Hello'
>>> l = listen(fam='ipv6', timeout=5)
>>> assembly   = shellcraft.i386.linux.connect('ip6-localhost', l.lport, 'ipv6')
>>> p = run_assembly(assembly)
>>> assert l.wait_for_connection()
pwnlib.shellcraft.i386.linux.connectstager(host, port, network='ipv4')[source]

connect recvsize stager :param host, where to connect to: :param port, which port to connect to: :param network, ipv4 or ipv6? (default: ipv4)

pwnlib.shellcraft.i386.linux.creat(file, mode)[source]

Invokes the syscall creat. See ‘man 2 creat’ for more information.

Parameters:
  • file (char) – file
  • mode (mode_t) – mode
pwnlib.shellcraft.i386.linux.dir(in_fd='ebp', size=2048, allocate_stack=True)[source]

Reads to the stack from a directory.

Parameters:
  • in_fd (int/str) – File descriptor to be read from.
  • size (int) – Buffer size.
  • allocate_stack (bool) – allocate ‘size’ bytes on the stack.

You can optioanlly shave a few bytes not allocating the stack space.

The size read is left in eax.

pwnlib.shellcraft.i386.linux.dup(fd, fd2)[source]

Invokes the syscall dup. See ‘man 2 dup’ for more information.

Parameters:fd (int) – fd
pwnlib.shellcraft.i386.linux.dup2(fd, fd2)[source]

Invokes the syscall dup2. See ‘man 2 dup2’ for more information.

Parameters:
  • fd (int) – fd
  • fd2 (int) – fd2
pwnlib.shellcraft.i386.linux.dup3(fd, fd2, flags)[source]

Invokes the syscall dup3. See ‘man 2 dup3’ for more information.

Parameters:
  • fd (int) – fd
  • fd2 (int) – fd2
  • flags (int) – flags
pwnlib.shellcraft.i386.linux.dupio(sock='ebp')[source]

Args: [sock (imm/reg) = ebp] Duplicates sock to stdin, stdout and stderr

pwnlib.shellcraft.i386.linux.dupsh(sock='ebp')[source]

Args: [sock (imm/reg) = ebp] Duplicates sock to stdin, stdout and stderr and spawns a shell.

pwnlib.shellcraft.i386.linux.echo(string, sock='1')[source]

Writes a string to a file descriptor

Example

>>> run_assembly(shellcraft.echo('hello', 1)).recvall()
'hello'
pwnlib.shellcraft.i386.linux.egghunter(egg, start_address = 0)[source]

Searches memory for the byte sequence ‘egg’.

Return value is the address immediately following the match, stored in RDI.

Parameters:
  • egg (str, int) – String of bytes, or word-size integer to search for
  • start_address (int) – Where to start the search
pwnlib.shellcraft.i386.linux.epoll_create(size)[source]

Invokes the syscall epoll_create. See ‘man 2 epoll_create’ for more information.

Parameters:size (int) – size
pwnlib.shellcraft.i386.linux.epoll_create1(flags)[source]

Invokes the syscall epoll_create1. See ‘man 2 epoll_create1’ for more information.

Parameters:flags (int) – flags
pwnlib.shellcraft.i386.linux.epoll_ctl(epfd, op, fd, event)[source]

Invokes the syscall epoll_ctl. See ‘man 2 epoll_ctl’ for more information.

Parameters:
  • epfd (int) – epfd
  • op (int) – op
  • fd (int) – fd
  • event (epoll_event) – event
pwnlib.shellcraft.i386.linux.epoll_pwait(epfd, events, maxevents, timeout, ss)[source]

Invokes the syscall epoll_pwait. See ‘man 2 epoll_pwait’ for more information.

Parameters:
  • epfd (int) – epfd
  • events (epoll_event) – events
  • maxevents (int) – maxevents
  • timeout (int) – timeout
  • ss (sigset_t) – ss
pwnlib.shellcraft.i386.linux.epoll_wait(epfd, events, maxevents, timeout)[source]

Invokes the syscall epoll_wait. See ‘man 2 epoll_wait’ for more information.

Parameters:
  • epfd (int) – epfd
  • events (epoll_event) – events
  • maxevents (int) – maxevents
  • timeout (int) – timeout
pwnlib.shellcraft.i386.linux.execve(path='/bin///sh', argv=0, envp=0)[source]

Execute a different process.

Attempts to perform some automatic detection of types. Otherwise, the arguments behave as normal.

  • If path is a string that is not a known register, it is pushed onto the stack.
  • If argv is an array of strings, it is pushed onto the stack, and NULL-terminated.
  • If envp is an dictionary of {string:string}, it is pushed onto the stack, and NULL-terminated.

Example

>>> path = '/bin/sh'
>>> argv = ['sh', '-c', 'echo Hello, $NAME; exit $STATUS']
>>> envp = {'NAME': 'zerocool', 'STATUS': 3}
>>> sc = shellcraft.i386.linux.execve(path, argv, envp)
>>> io = run_assembly(sc)
>>> io.recvall()
'Hello, zerocool\n'
>>> io.poll(True)
3
pwnlib.shellcraft.i386.linux.exit(status=None)[source]

Invokes the syscall exit. See ‘man 2 exit’ for more information.

Parameters:status (int) – status

Doctest

>>> run_assembly_exitcode(shellcraft.exit(33))
33
pwnlib.shellcraft.i386.linux.faccessat(fd, file, type, flag)[source]

Invokes the syscall faccessat. See ‘man 2 faccessat’ for more information.

Parameters:
  • fd (int) – fd
  • file (char) – file
  • type (int) – type
  • flag (int) – flag
pwnlib.shellcraft.i386.linux.fallocate(fd, mode, offset, length)[source]

Invokes the syscall fallocate. See ‘man 2 fallocate’ for more information.

Parameters:
  • fd (int) – fd
  • mode (int) – mode
  • offset (off_t) – offset
  • len (off_t) – len
pwnlib.shellcraft.i386.linux.fchdir(fd)[source]

Invokes the syscall fchdir. See ‘man 2 fchdir’ for more information.

Parameters:fd (int) – fd
pwnlib.shellcraft.i386.linux.fchmod(fd, mode)[source]

Invokes the syscall fchmod. See ‘man 2 fchmod’ for more information.

Parameters:
  • fd (int) – fd
  • mode (mode_t) – mode
pwnlib.shellcraft.i386.linux.fchmodat(fd, file, mode, flag)[source]

Invokes the syscall fchmodat. See ‘man 2 fchmodat’ for more information.

Parameters:
  • fd (int) – fd
  • file (char) – file
  • mode (mode_t) – mode
  • flag (int) – flag
pwnlib.shellcraft.i386.linux.fchown(fd, owner, group)[source]

Invokes the syscall fchown. See ‘man 2 fchown’ for more information.

Parameters:
  • fd (int) – fd
  • owner (uid_t) – owner
  • group (gid_t) – group
pwnlib.shellcraft.i386.linux.fchownat(fd, file, owner, group, flag)[source]

Invokes the syscall fchownat. See ‘man 2 fchownat’ for more information.

Parameters:
  • fd (int) – fd
  • file (char) – file
  • owner (uid_t) – owner
  • group (gid_t) – group
  • flag (int) – flag
pwnlib.shellcraft.i386.linux.fcntl(fd, cmd, vararg)[source]

Invokes the syscall fcntl. See ‘man 2 fcntl’ for more information.

Parameters:
  • fd (int) – fd
  • cmd (int) – cmd
  • vararg (int) – vararg
pwnlib.shellcraft.i386.linux.fdatasync(fildes)[source]

Invokes the syscall fdatasync. See ‘man 2 fdatasync’ for more information.

Parameters:fildes (int) – fildes
pwnlib.shellcraft.i386.linux.findpeer(port=None)[source]

Args: port (defaults to any port) Finds a socket, which is connected to the specified port. Leaves socket in ESI.

pwnlib.shellcraft.i386.linux.findpeersh(port=None)[source]

Args: port (defaults to any) Finds an open socket which connects to a specified port, and then opens a dup2 shell on it.

pwnlib.shellcraft.i386.linux.findpeerstager(port=None)[source]

Findpeer recvsize stager :param port, the port given to findpeer: :type port, the port given to findpeer: defaults to any

pwnlib.shellcraft.i386.linux.flock(fd, operation)[source]

Invokes the syscall flock. See ‘man 2 flock’ for more information.

Parameters:
  • fd (int) – fd
  • operation (int) – operation
pwnlib.shellcraft.i386.linux.fork()[source]

Invokes the syscall fork. See ‘man 2 fork’ for more information.

Arguments:

pwnlib.shellcraft.i386.linux.forkbomb()[source]

Performs a forkbomb attack.

pwnlib.shellcraft.i386.linux.forkexit()[source]

Attempts to fork. If the fork is successful, the parent exits.

pwnlib.shellcraft.i386.linux.fstat(fd, buf)[source]

Invokes the syscall fstat. See ‘man 2 fstat’ for more information.

Parameters:
  • fd (int) – fd
  • buf (stat) – buf
pwnlib.shellcraft.i386.linux.fstat64(fd, buf)[source]

Invokes the syscall fstat64. See ‘man 2 fstat64’ for more information.

Parameters:
pwnlib.shellcraft.i386.linux.fstatat64(fd, file, buf, flag)[source]

Invokes the syscall fstatat64. See ‘man 2 fstatat64’ for more information.

Parameters:
  • fd (int) – fd
  • file (char) – file
  • buf (stat64) – buf
  • flag (int) – flag
pwnlib.shellcraft.i386.linux.fsync(fd)[source]

Invokes the syscall fsync. See ‘man 2 fsync’ for more information.

Parameters:fd (int) – fd
pwnlib.shellcraft.i386.linux.ftruncate(fd, length)[source]

Invokes the syscall ftruncate. See ‘man 2 ftruncate’ for more information.

Parameters:
  • fd (int) – fd
  • length (off_t) – length
pwnlib.shellcraft.i386.linux.ftruncate64(fd, length)[source]

Invokes the syscall ftruncate64. See ‘man 2 ftruncate64’ for more information.

Parameters:
  • fd (int) – fd
  • length (off64_t) – length
pwnlib.shellcraft.i386.linux.futimesat(fd, file, tvp)[source]

Invokes the syscall futimesat. See ‘man 2 futimesat’ for more information.

Parameters:
  • fd (int) – fd
  • file (char) – file
  • tvp (timeval) – tvp
pwnlib.shellcraft.i386.linux.getcwd(buf, size)[source]

Invokes the syscall getcwd. See ‘man 2 getcwd’ for more information.

Parameters:
  • buf (char) – buf
  • size (size_t) – size
pwnlib.shellcraft.i386.linux.getdents(fd, dirp, count)[source]

Invokes the syscall getdents. See ‘man 2 getdents’ for more information.

Parameters:
  • fd (int) – fd
  • dirp (int) – dirp
  • count (int) – count
pwnlib.shellcraft.i386.linux.getegid()[source]

Invokes the syscall getegid. See ‘man 2 getegid’ for more information.

Arguments:

pwnlib.shellcraft.i386.linux.geteuid()[source]

Invokes the syscall geteuid. See ‘man 2 geteuid’ for more information.

Arguments:

pwnlib.shellcraft.i386.linux.getgid()[source]

Invokes the syscall getgid. See ‘man 2 getgid’ for more information.

Arguments:

pwnlib.shellcraft.i386.linux.getgroups(size, list)[source]

Invokes the syscall getgroups. See ‘man 2 getgroups’ for more information.

Parameters:
  • size (int) – size
  • list (gid_t) – list
pwnlib.shellcraft.i386.linux.getitimer(which, value)[source]

Invokes the syscall getitimer. See ‘man 2 getitimer’ for more information.

Parameters:
  • which (itimer_which_t) – which
  • value (itimerval) – value
pwnlib.shellcraft.i386.linux.getpeername(fd, addr, length)[source]

Invokes the syscall getpeername. See ‘man 2 getpeername’ for more information.

Parameters:
  • fd (int) – fd
  • addr (SOCKADDR_ARG) – addr
  • len (socklen_t) – len
pwnlib.shellcraft.i386.linux.getpgid(pid)[source]

Invokes the syscall getpgid. See ‘man 2 getpgid’ for more information.

Parameters:pid (pid_t) – pid
pwnlib.shellcraft.i386.linux.getpgrp()[source]

Invokes the syscall getpgrp. See ‘man 2 getpgrp’ for more information.

Arguments:

pwnlib.shellcraft.i386.linux.getpid()[source]

Invokes the syscall getpid. See ‘man 2 getpid’ for more information.

Arguments:

pwnlib.shellcraft.i386.linux.getpmsg(fildes, ctlptr, dataptr, bandp, flagsp)[source]

Invokes the syscall getpmsg. See ‘man 2 getpmsg’ for more information.

Parameters:
  • fildes (int) – fildes
  • ctlptr (strbuf) – ctlptr
  • dataptr (strbuf) – dataptr
  • bandp (int) – bandp
  • flagsp (int) – flagsp
pwnlib.shellcraft.i386.linux.getppid()[source]

Invokes the syscall getppid. See ‘man 2 getppid’ for more information.

Arguments:

pwnlib.shellcraft.i386.linux.getpriority(which, who)[source]

Invokes the syscall getpriority. See ‘man 2 getpriority’ for more information.

Parameters:
  • which (priority_which_t) – which
  • who (id_t) – who
pwnlib.shellcraft.i386.linux.getresgid(rgid, egid, sgid)[source]

Invokes the syscall getresgid. See ‘man 2 getresgid’ for more information.

Parameters:
  • rgid (gid_t) – rgid
  • egid (gid_t) – egid
  • sgid (gid_t) – sgid
pwnlib.shellcraft.i386.linux.getresuid(ruid, euid, suid)[source]

Invokes the syscall getresuid. See ‘man 2 getresuid’ for more information.

Parameters:
  • ruid (uid_t) – ruid
  • euid (uid_t) – euid
  • suid (uid_t) – suid
pwnlib.shellcraft.i386.linux.getrlimit(resource, rlimits)[source]

Invokes the syscall getrlimit. See ‘man 2 getrlimit’ for more information.

Parameters:
  • resource (rlimit_resource_t) – resource
  • rlimits (rlimit) – rlimits
pwnlib.shellcraft.i386.linux.getrusage(who, usage)[source]

Invokes the syscall getrusage. See ‘man 2 getrusage’ for more information.

Parameters:
  • who (rusage_who_t) – who
  • usage (rusage) – usage
pwnlib.shellcraft.i386.linux.getsid(pid)[source]

Invokes the syscall getsid. See ‘man 2 getsid’ for more information.

Parameters:pid (pid_t) – pid
pwnlib.shellcraft.i386.linux.getsockname(fd, addr, length)[source]

Invokes the syscall getsockname. See ‘man 2 getsockname’ for more information.

Parameters:
  • fd (int) – fd
  • addr (SOCKADDR_ARG) – addr
  • len (socklen_t) – len
pwnlib.shellcraft.i386.linux.getsockopt(fd, level, optname, optval, optlen)[source]

Invokes the syscall getsockopt. See ‘man 2 getsockopt’ for more information.

Parameters:
  • fd (int) – fd
  • level (int) – level
  • optname (int) – optname
  • optval (void) – optval
  • optlen (socklen_t) – optlen
pwnlib.shellcraft.i386.linux.gettimeofday(tv, tz)[source]

Invokes the syscall gettimeofday. See ‘man 2 gettimeofday’ for more information.

Parameters:
  • tv (timeval) – tv
  • tz (timezone_ptr_t) – tz
pwnlib.shellcraft.i386.linux.getuid()[source]

Invokes the syscall getuid. See ‘man 2 getuid’ for more information.

Arguments:

pwnlib.shellcraft.i386.linux.gtty(fd, params)[source]

Invokes the syscall gtty. See ‘man 2 gtty’ for more information.

Parameters:
  • fd (int) – fd
  • params (sgttyb) – params
pwnlib.shellcraft.i386.linux.i386_to_amd64()[source]

Returns code to switch from i386 to amd64 mode.

pwnlib.shellcraft.i386.linux.ioctl(fd, request, vararg)[source]

Invokes the syscall ioctl. See ‘man 2 ioctl’ for more information.

Parameters:
  • fd (int) – fd
  • request (unsigned) – request
  • vararg (int) – vararg
pwnlib.shellcraft.i386.linux.ioperm(from_, num, turn_on)[source]

Invokes the syscall ioperm. See ‘man 2 ioperm’ for more information.

Parameters:
  • from (unsigned) – from
  • num (unsigned) – num
  • turn_on (int) – turn_on
pwnlib.shellcraft.i386.linux.iopl(level)[source]

Invokes the syscall iopl. See ‘man 2 iopl’ for more information.

Parameters:level (int) – level
pwnlib.shellcraft.i386.linux.kill(pid, sig)[source]

Invokes the syscall kill. See ‘man 2 kill’ for more information.

Parameters:
  • pid (pid_t) – pid
  • sig (int) – sig
pwnlib.shellcraft.i386.linux.killparent()[source]

Kills its parent process until whatever the parent is (probably init) cannot be killed any longer.

pwnlib.shellcraft.i386.linux.lchown(file, owner, group)[source]

Invokes the syscall lchown. See ‘man 2 lchown’ for more information.

Parameters:
  • file (char) – file
  • owner (uid_t) – owner
  • group (gid_t) – group

Invokes the syscall link. See ‘man 2 link’ for more information.

Parameters:
  • from (char) – from
  • to (char) – to
pwnlib.shellcraft.i386.linux.linkat(fromfd, from_, tofd, to, flags)[source]

Invokes the syscall linkat. See ‘man 2 linkat’ for more information.

Parameters:
  • fromfd (int) – fromfd
  • from (char) – from
  • tofd (int) – tofd
  • to (char) – to
  • flags (int) – flags
pwnlib.shellcraft.i386.linux.listen(fd, n)[source]

Invokes the syscall listen. See ‘man 2 listen’ for more information.

Parameters:
  • fd (int) – fd
  • n (int) – n
pwnlib.shellcraft.i386.linux.loader(address)[source]

Loads a statically-linked ELF into memory and transfers control.

Parameters:address (int) – Address of the ELF as a register or integer.
pwnlib.shellcraft.i386.linux.loader_append(data=None)[source]

Loads a statically-linked ELF into memory and transfers control.

Similar to loader.asm but loads an appended ELF.

Parameters:data (str) – If a valid filename, the data is loaded from the named file. Otherwise, this is treated as raw ELF data to append. If None, it is ignored.

Example

>>> gcc = process(['gcc','-m32','-xc','-static','-Wl,-Ttext-segment=0x20000000','-'])
>>> gcc.write('''
... int main() {
...     printf("Hello, %s!\\n", "i386");
... }
... ''')
>>> gcc.shutdown('send')
>>> gcc.poll(True)
0
>>> sc = shellcraft.loader_append('a.out')

The following doctest is commented out because it doesn’t work on Travis for reasons I cannot diagnose. However, it should work just fine :-)

# >>> run_assembly(sc).recvline() == ‘Hello, i386!n’ # True
pwnlib.shellcraft.i386.linux.lseek(fd, offset, whence)[source]

Invokes the syscall lseek. See ‘man 2 lseek’ for more information.

Parameters:
  • fd (int) – fd
  • offset (off_t) – offset
  • whence (int) – whence
pwnlib.shellcraft.i386.linux.lstat(file, buf)[source]

Invokes the syscall lstat. See ‘man 2 lstat’ for more information.

Parameters:
  • file (char) – file
  • buf (stat) – buf
pwnlib.shellcraft.i386.linux.lstat64(file, buf)[source]

Invokes the syscall lstat64. See ‘man 2 lstat64’ for more information.

Parameters:
  • file (char) – file
  • buf (stat64) – buf
pwnlib.shellcraft.i386.linux.madvise(addr, length, advice)[source]

Invokes the syscall madvise. See ‘man 2 madvise’ for more information.

Parameters:
  • addr (void) – addr
  • len (size_t) – len
  • advice (int) – advice
pwnlib.shellcraft.i386.linux.mincore(start, length, vec)[source]

Invokes the syscall mincore. See ‘man 2 mincore’ for more information.

Parameters:
  • start (void) – start
  • len (size_t) – len
  • vec (unsigned) – vec
pwnlib.shellcraft.i386.linux.mkdir(path, mode)[source]

Invokes the syscall mkdir. See ‘man 2 mkdir’ for more information.

Parameters:
  • path (char) – path
  • mode (mode_t) – mode
pwnlib.shellcraft.i386.linux.mkdirat(fd, path, mode)[source]

Invokes the syscall mkdirat. See ‘man 2 mkdirat’ for more information.

Parameters:
  • fd (int) – fd
  • path (char) – path
  • mode (mode_t) – mode
pwnlib.shellcraft.i386.linux.mknod(path, mode, dev)[source]

Invokes the syscall mknod. See ‘man 2 mknod’ for more information.

Parameters:
  • path (char) – path
  • mode (mode_t) – mode
  • dev (dev_t) – dev
pwnlib.shellcraft.i386.linux.mknodat(fd, path, mode, dev)[source]

Invokes the syscall mknodat. See ‘man 2 mknodat’ for more information.

Parameters:
  • fd (int) – fd
  • path (char) – path
  • mode (mode_t) – mode
  • dev (dev_t) – dev
pwnlib.shellcraft.i386.linux.mlock(addr, length)[source]

Invokes the syscall mlock. See ‘man 2 mlock’ for more information.

Parameters:
  • addr (void) – addr
  • len (size_t) – len
pwnlib.shellcraft.i386.linux.mlockall(flags)[source]

Invokes the syscall mlockall. See ‘man 2 mlockall’ for more information.

Parameters:flags (int) – flags
pwnlib.shellcraft.i386.linux.mmap(addr=0, length=4096, prot=7, flags=34, fd=-1, offset=0)[source]

Invokes the syscall mmap. See ‘man 2 mmap’ for more information.

Parameters:
  • addr (void) – addr
  • length (size_t) – length
  • prot (int) – prot
  • flags (int) – flags
  • fd (int) – fd
  • offset (off_t) – offset
pwnlib.shellcraft.i386.linux.mov(dest, src, stack_allowed=True)[source]

Thin wrapper around pwnlib.shellcraft.i386.mov(), which sets context.os to ‘linux’ before calling.

Example

>>> print pwnlib.shellcraft.i386.linux.mov('eax', 'SYS_execve').rstrip()
    push (SYS_execve) /* 0xb */
    pop eax
pwnlib.shellcraft.i386.linux.mprotect(addr, length, prot)[source]

Invokes the syscall mprotect. See ‘man 2 mprotect’ for more information.

Parameters:
  • addr (void) – addr
  • len (size_t) – len
  • prot (int) – prot
pwnlib.shellcraft.i386.linux.mprotect_all(clear_ebx=True, fix_null=False)[source]

Calls mprotect(page, 4096, PROT_READ | PROT_WRITE | PROT_EXEC) for every page.

It takes around 0.3 seconds on my box, but your milage may vary.

Parameters:
  • clear_ebx (bool) – If this is set to False, then the shellcode will assume that ebx has already been zeroed.
  • fix_null (bool) – If this is set to True, then the NULL-page will also be mprotected at the cost of slightly larger shellcode
pwnlib.shellcraft.i386.linux.mq_notify(mqdes, notification)[source]

Invokes the syscall mq_notify. See ‘man 2 mq_notify’ for more information.

Parameters:
  • mqdes (mqd_t) – mqdes
  • notification (sigevent) – notification
pwnlib.shellcraft.i386.linux.mq_open(name, oflag, vararg)[source]

Invokes the syscall mq_open. See ‘man 2 mq_open’ for more information.

Parameters:
  • name (char) – name
  • oflag (int) – oflag
  • vararg (int) – vararg
pwnlib.shellcraft.i386.linux.mq_timedreceive(mqdes, msg_ptr, msg_len, msg_prio, abs_timeout)[source]

Invokes the syscall mq_timedreceive. See ‘man 2 mq_timedreceive’ for more information.

Parameters:
  • mqdes (mqd_t) – mqdes
  • msg_ptr (char) – msg_ptr
  • msg_len (size_t) – msg_len
  • msg_prio (unsigned) – msg_prio
  • abs_timeout (timespec) – abs_timeout
pwnlib.shellcraft.i386.linux.mq_timedsend(mqdes, msg_ptr, msg_len, msg_prio, abs_timeout)[source]

Invokes the syscall mq_timedsend. See ‘man 2 mq_timedsend’ for more information.

Parameters:
  • mqdes (mqd_t) – mqdes
  • msg_ptr (char) – msg_ptr
  • msg_len (size_t) – msg_len
  • msg_prio (unsigned) – msg_prio
  • abs_timeout (timespec) – abs_timeout

Invokes the syscall mq_unlink. See ‘man 2 mq_unlink’ for more information.

Parameters:name (char) – name
pwnlib.shellcraft.i386.linux.mremap(addr, old_len, new_len, flags, vararg)[source]

Invokes the syscall mremap. See ‘man 2 mremap’ for more information.

Parameters:
  • addr (void) – addr
  • old_len (size_t) – old_len
  • new_len (size_t) – new_len
  • flags (int) – flags
  • vararg (int) – vararg
pwnlib.shellcraft.i386.linux.msync(addr, length, flags)[source]

Invokes the syscall msync. See ‘man 2 msync’ for more information.

Parameters:
  • addr (void) – addr
  • len (size_t) – len
  • flags (int) – flags
pwnlib.shellcraft.i386.linux.munlock(addr, length)[source]

Invokes the syscall munlock. See ‘man 2 munlock’ for more information.

Parameters:
  • addr (void) – addr
  • len (size_t) – len
pwnlib.shellcraft.i386.linux.munlockall()[source]

Invokes the syscall munlockall. See ‘man 2 munlockall’ for more information.

Arguments:

pwnlib.shellcraft.i386.linux.munmap(addr, length)[source]

Invokes the syscall munmap. See ‘man 2 munmap’ for more information.

Parameters:
  • addr (void) – addr
  • len (size_t) – len
pwnlib.shellcraft.i386.linux.nanosleep(requested_time, remaining)[source]

Invokes the syscall nanosleep. See ‘man 2 nanosleep’ for more information.

Parameters:
  • requested_time (timespec) – requested_time
  • remaining (timespec) – remaining
pwnlib.shellcraft.i386.linux.nice(inc)[source]

Invokes the syscall nice. See ‘man 2 nice’ for more information.

Parameters:inc (int) – inc
pwnlib.shellcraft.i386.linux.open(file, oflag, vararg)[source]

Invokes the syscall open. See ‘man 2 open’ for more information.

Parameters:
  • file (char) – file
  • oflag (int) – oflag
  • vararg (int) – vararg
pwnlib.shellcraft.i386.linux.openat(fd, file, oflag, vararg)[source]

Invokes the syscall openat. See ‘man 2 openat’ for more information.

Parameters:
  • fd (int) – fd
  • file (char) – file
  • oflag (int) – oflag
  • vararg (int) – vararg
pwnlib.shellcraft.i386.linux.pause()[source]

Invokes the syscall pause. See ‘man 2 pause’ for more information.

Arguments:

pwnlib.shellcraft.i386.linux.pidmax()[source]

Retrieves the highest numbered PID on the system, according to the sysctl kernel.pid_max.

pwnlib.shellcraft.i386.linux.pipe(pipedes)[source]

Invokes the syscall pipe. See ‘man 2 pipe’ for more information.

Parameters:pipedes (int) – pipedes
pwnlib.shellcraft.i386.linux.pipe2(pipedes, flags)[source]

Invokes the syscall pipe2. See ‘man 2 pipe2’ for more information.

Parameters:
  • pipedes (int) – pipedes
  • flags (int) – flags
pwnlib.shellcraft.i386.linux.poll(fds, nfds, timeout)[source]

Invokes the syscall poll. See ‘man 2 poll’ for more information.

Parameters:
  • fds (pollfd) – fds
  • nfds (nfds_t) – nfds
  • timeout (int) – timeout
pwnlib.shellcraft.i386.linux.ppoll(fds, nfds, timeout, ss)[source]

Invokes the syscall ppoll. See ‘man 2 ppoll’ for more information.

Parameters:
  • fds (pollfd) – fds
  • nfds (nfds_t) – nfds
  • timeout (timespec) – timeout
  • ss (sigset_t) – ss
pwnlib.shellcraft.i386.linux.prctl(option, *vararg)[source]

Invokes the syscall prctl. See ‘man 2 prctl’ for more information.

Parameters:
  • option (int) – option
  • vararg (int) – vararg
pwnlib.shellcraft.i386.linux.pread(fd, buf, nbytes, offset)[source]

Invokes the syscall pread. See ‘man 2 pread’ for more information.

Parameters:
  • fd (int) – fd
  • buf (void) – buf
  • nbytes (size_t) – nbytes
  • offset (off_t) – offset
pwnlib.shellcraft.i386.linux.preadv(fd, iovec, count, offset)[source]

Invokes the syscall preadv. See ‘man 2 preadv’ for more information.

Parameters:
  • fd (int) – fd
  • iovec (iovec) – iovec
  • count (int) – count
  • offset (off_t) – offset
pwnlib.shellcraft.i386.linux.prlimit64(pid, resource, new_limit, old_limit)[source]

Invokes the syscall prlimit64. See ‘man 2 prlimit64’ for more information.

Parameters:
  • pid (pid_t) – pid
  • resource (rlimit_resource) – resource
  • new_limit (rlimit64) – new_limit
  • old_limit (rlimit64) – old_limit
pwnlib.shellcraft.i386.linux.profil(sample_buffer, size, offset, scale)[source]

Invokes the syscall profil. See ‘man 2 profil’ for more information.

Parameters:
  • sample_buffer (unsigned) – sample_buffer
  • size (size_t) – size
  • offset (size_t) – offset
  • scale (unsigned) – scale
pwnlib.shellcraft.i386.linux.ptrace(request, *vararg)[source]

Invokes the syscall ptrace. See ‘man 2 ptrace’ for more information.

Parameters:
  • request (ptrace_request) – request
  • vararg (int) – vararg
pwnlib.shellcraft.i386.linux.push(value)[source]

Thin wrapper around pwnlib.shellcraft.i386.push(), which sets context.os to ‘linux’ before calling.

Example

>>> print pwnlib.shellcraft.i386.linux.push('SYS_execve').rstrip()
    /* push (SYS_execve) (0xb) */
    push 0xb
pwnlib.shellcraft.i386.linux.putpmsg(fildes, ctlptr, dataptr, band, flags)[source]

Invokes the syscall putpmsg. See ‘man 2 putpmsg’ for more information.

Parameters:
  • fildes (int) – fildes
  • ctlptr (strbuf) – ctlptr
  • dataptr (strbuf) – dataptr
  • band (int) – band
  • flags (int) – flags
pwnlib.shellcraft.i386.linux.pwrite(fd, buf, n, offset)[source]

Invokes the syscall pwrite. See ‘man 2 pwrite’ for more information.

Parameters:
  • fd (int) – fd
  • buf (void) – buf
  • n (size_t) – n
  • offset (off_t) – offset
pwnlib.shellcraft.i386.linux.pwritev(fd, iovec, count, offset)[source]

Invokes the syscall pwritev. See ‘man 2 pwritev’ for more information.

Parameters:
  • fd (int) – fd
  • iovec (iovec) – iovec
  • count (int) – count
  • offset (off_t) – offset
pwnlib.shellcraft.i386.linux.read(fd, buf, nbytes)[source]

Invokes the syscall read. See ‘man 2 read’ for more information.

Parameters:
  • fd (int) – fd
  • buf (void) – buf
  • nbytes (size_t) – nbytes
pwnlib.shellcraft.i386.linux.readahead(fd, offset, count)[source]

Invokes the syscall readahead. See ‘man 2 readahead’ for more information.

Parameters:
  • fd (int) – fd
  • offset (off64_t) – offset
  • count (size_t) – count
pwnlib.shellcraft.i386.linux.readdir(dirp)[source]

Invokes the syscall readdir. See ‘man 2 readdir’ for more information.

Parameters:dirp (DIR) – dirp
pwnlib.shellcraft.i386.linux.readfile(path, dst='esi')[source]

Args: [path, dst (imm/reg) = esi ] Opens the specified file path and sends its content to the specified file descriptor.

Invokes the syscall readlink. See ‘man 2 readlink’ for more information.

Parameters:
  • path (char) – path
  • buf (char) – buf
  • len (size_t) – len
pwnlib.shellcraft.i386.linux.readlinkat(fd, path, buf, length)[source]

Invokes the syscall readlinkat. See ‘man 2 readlinkat’ for more information.

Parameters:
  • fd (int) – fd
  • path (char) – path
  • buf (char) – buf
  • len (size_t) – len
pwnlib.shellcraft.i386.linux.readn(fd, buf, nbytes)[source]

Reads exactly nbytes bytes from file descriptor fd into the buffer buf.

Parameters:
  • fd (int) – fd
  • buf (void) – buf
  • nbytes (size_t) – nbytes
pwnlib.shellcraft.i386.linux.readv(fd, iovec, count)[source]

Invokes the syscall readv. See ‘man 2 readv’ for more information.

Parameters:
  • fd (int) – fd
  • iovec (iovec) – iovec
  • count (int) – count
pwnlib.shellcraft.i386.linux.recv(fd, buf, n, flags)[source]

Invokes the syscall recv. See ‘man 2 recv’ for more information.

Parameters:
  • fd (int) – fd
  • buf (void) – buf
  • n (size_t) – n
  • flags (int) – flags
pwnlib.shellcraft.i386.linux.recvfrom(fd, buf, n, flags, addr, addr_len)[source]

Invokes the syscall recvfrom. See ‘man 2 recvfrom’ for more information.

Parameters:
  • fd (int) – fd
  • buf (void) – buf
  • n (size_t) – n
  • flags (int) – flags
  • addr (SOCKADDR_ARG) – addr
  • addr_len (socklen_t) – addr_len
pwnlib.shellcraft.i386.linux.recvmmsg(fd, vmessages, vlen, flags, tmo)[source]

Invokes the syscall recvmmsg. See ‘man 2 recvmmsg’ for more information.

Parameters:
  • fd (int) – fd
  • vmessages (mmsghdr) – vmessages
  • vlen (unsigned) – vlen
  • flags (int) – flags
  • tmo (timespec) – tmo
pwnlib.shellcraft.i386.linux.recvmsg(fd, message, flags)[source]

Invokes the syscall recvmsg. See ‘man 2 recvmsg’ for more information.

Parameters:
  • fd (int) – fd
  • message (msghdr) – message
  • flags (int) – flags
pwnlib.shellcraft.i386.linux.recvsize(sock, reg='ecx')[source]

Recives 4 bytes size field Useful in conjuncion with findpeer and stager :param sock, the socket to read the payload from.: :param reg, the place to put the size: :type reg, the place to put the size: default ecx

Leaves socket in ebx

pwnlib.shellcraft.i386.linux.remap_file_pages(start, size, prot, pgoff, flags)[source]

Invokes the syscall remap_file_pages. See ‘man 2 remap_file_pages’ for more information.

Parameters:
  • start (void) – start
  • size (size_t) – size
  • prot (int) – prot
  • pgoff (size_t) – pgoff
  • flags (int) – flags
pwnlib.shellcraft.i386.linux.rename(old, new)[source]

Invokes the syscall rename. See ‘man 2 rename’ for more information.

Parameters:
  • old (char) – old
  • new (char) – new
pwnlib.shellcraft.i386.linux.renameat(oldfd, old, newfd, new)[source]

Invokes the syscall renameat. See ‘man 2 renameat’ for more information.

Parameters:
  • oldfd (int) – oldfd
  • old (char) – old
  • newfd (int) – newfd
  • new (char) – new
pwnlib.shellcraft.i386.linux.rmdir(path)[source]

Invokes the syscall rmdir. See ‘man 2 rmdir’ for more information.

Parameters:path (char) – path
pwnlib.shellcraft.i386.linux.sched_get_priority_max(algorithm)[source]

Invokes the syscall sched_get_priority_max. See ‘man 2 sched_get_priority_max’ for more information.

Parameters:algorithm (int) – algorithm
pwnlib.shellcraft.i386.linux.sched_get_priority_min(algorithm)[source]

Invokes the syscall sched_get_priority_min. See ‘man 2 sched_get_priority_min’ for more information.

Parameters:algorithm (int) – algorithm
pwnlib.shellcraft.i386.linux.sched_getaffinity(pid, cpusetsize, cpuset)[source]

Invokes the syscall sched_getaffinity. See ‘man 2 sched_getaffinity’ for more information.

Parameters:
  • pid (pid_t) – pid
  • cpusetsize (size_t) – cpusetsize
  • cpuset (cpu_set_t) – cpuset
pwnlib.shellcraft.i386.linux.sched_getparam(pid, param)[source]

Invokes the syscall sched_getparam. See ‘man 2 sched_getparam’ for more information.

Parameters:
  • pid (pid_t) – pid
  • param (sched_param) – param
pwnlib.shellcraft.i386.linux.sched_getscheduler(pid)[source]

Invokes the syscall sched_getscheduler. See ‘man 2 sched_getscheduler’ for more information.

Parameters:pid (pid_t) – pid
pwnlib.shellcraft.i386.linux.sched_rr_get_interval(pid, t)[source]

Invokes the syscall sched_rr_get_interval. See ‘man 2 sched_rr_get_interval’ for more information.

Parameters:
  • pid (pid_t) – pid
  • t (timespec) – t
pwnlib.shellcraft.i386.linux.sched_setaffinity(pid, cpusetsize, cpuset)[source]

Invokes the syscall sched_setaffinity. See ‘man 2 sched_setaffinity’ for more information.

Parameters:
  • pid (pid_t) – pid
  • cpusetsize (size_t) – cpusetsize
  • cpuset (cpu_set_t) – cpuset
pwnlib.shellcraft.i386.linux.sched_setparam(pid, param)[source]

Invokes the syscall sched_setparam. See ‘man 2 sched_setparam’ for more information.

Parameters:
  • pid (pid_t) – pid
  • param (sched_param) – param
pwnlib.shellcraft.i386.linux.sched_setscheduler(pid, policy, param)[source]

Invokes the syscall sched_setscheduler. See ‘man 2 sched_setscheduler’ for more information.

Parameters:
  • pid (pid_t) – pid
  • policy (int) – policy
  • param (sched_param) – param
pwnlib.shellcraft.i386.linux.sched_yield()[source]

Invokes the syscall sched_yield. See ‘man 2 sched_yield’ for more information.

Arguments:

pwnlib.shellcraft.i386.linux.select(nfds, readfds, writefds, exceptfds, timeout)[source]

Invokes the syscall select. See ‘man 2 select’ for more information.

Parameters:
  • nfds (int) – nfds
  • readfds (fd_set) – readfds
  • writefds (fd_set) – writefds
  • exceptfds (fd_set) – exceptfds
  • timeout (timeval) – timeout
pwnlib.shellcraft.i386.linux.sendfile(out_fd, in_fd, offset, count)[source]

Invokes the syscall sendfile. See ‘man 2 sendfile’ for more information.

Parameters:
  • out_fd (int) – out_fd
  • in_fd (int) – in_fd
  • offset (off_t) – offset
  • count (size_t) – count
pwnlib.shellcraft.i386.linux.sendfile64(out_fd, in_fd, offset, count)[source]

Invokes the syscall sendfile64. See ‘man 2 sendfile64’ for more information.

Parameters:
  • out_fd (int) – out_fd
  • in_fd (int) – in_fd
  • offset (off64_t) – offset
  • count (size_t) – count
pwnlib.shellcraft.i386.linux.setdomainname(name, length)[source]

Invokes the syscall setdomainname. See ‘man 2 setdomainname’ for more information.

Parameters:
  • name (char) – name
  • len (size_t) – len
pwnlib.shellcraft.i386.linux.setgid(gid)[source]

Invokes the syscall setgid. See ‘man 2 setgid’ for more information.

Parameters:gid (gid_t) – gid
pwnlib.shellcraft.i386.linux.setgroups(n, groups)[source]

Invokes the syscall setgroups. See ‘man 2 setgroups’ for more information.

Parameters:
  • n (size_t) – n
  • groups (gid_t) – groups
pwnlib.shellcraft.i386.linux.sethostname(name, length)[source]

Invokes the syscall sethostname. See ‘man 2 sethostname’ for more information.

Parameters:
  • name (char) – name
  • len (size_t) – len
pwnlib.shellcraft.i386.linux.setitimer(which, new, old)[source]

Invokes the syscall setitimer. See ‘man 2 setitimer’ for more information.

Parameters:
  • which (itimer_which_t) – which
  • new (itimerval) – new
  • old (itimerval) – old
pwnlib.shellcraft.i386.linux.setpgid(pid, pgid)[source]

Invokes the syscall setpgid. See ‘man 2 setpgid’ for more information.

Parameters:
  • pid (pid_t) – pid
  • pgid (pid_t) – pgid
pwnlib.shellcraft.i386.linux.setpriority(which, who, prio)[source]

Invokes the syscall setpriority. See ‘man 2 setpriority’ for more information.

Parameters:
  • which (priority_which_t) – which
  • who (id_t) – who
  • prio (int) – prio
pwnlib.shellcraft.i386.linux.setregid(gid='egid')[source]

Args: [gid (imm/reg) = egid] Sets the real and effective group id.

pwnlib.shellcraft.i386.linux.setresgid(rgid, egid, sgid)[source]

Invokes the syscall setresgid. See ‘man 2 setresgid’ for more information.

Parameters:
  • rgid (gid_t) – rgid
  • egid (gid_t) – egid
  • sgid (gid_t) – sgid
pwnlib.shellcraft.i386.linux.setresuid(ruid, euid, suid)[source]

Invokes the syscall setresuid. See ‘man 2 setresuid’ for more information.

Parameters:
  • ruid (uid_t) – ruid
  • euid (uid_t) – euid
  • suid (uid_t) – suid
pwnlib.shellcraft.i386.linux.setreuid(uid='euid')[source]

Args: [uid (imm/reg) = euid] Sets the real and effective user id.

pwnlib.shellcraft.i386.linux.setrlimit(resource, rlimits)[source]

Invokes the syscall setrlimit. See ‘man 2 setrlimit’ for more information.

Parameters:
  • resource (rlimit_resource_t) – resource
  • rlimits (rlimit) – rlimits
pwnlib.shellcraft.i386.linux.setsid()[source]

Invokes the syscall setsid. See ‘man 2 setsid’ for more information.

Arguments:

pwnlib.shellcraft.i386.linux.setsockopt(sockfd, level, optname, optval, optlen)[source]

Invokes the syscall setsockopt. See ‘man 2 setsockopt’ for more information.

Parameters:
  • sockfd (int) – sockfd
  • level (int) – level
  • optname (int) – optname
  • optval (void) – optval
  • optlen (int) – optlen
pwnlib.shellcraft.i386.linux.setsockopt_timeout(sock, secs)[source]

Invokes the syscall fork. See ‘man 2 fork’ for more information.

Parameters:
  • sock (int) – sock
  • secs (int) – secs
pwnlib.shellcraft.i386.linux.settimeofday(tv, tz)[source]

Invokes the syscall settimeofday. See ‘man 2 settimeofday’ for more information.

Parameters:
  • tv (timeval) – tv
  • tz (timezone) – tz
pwnlib.shellcraft.i386.linux.setuid(uid)[source]

Invokes the syscall setuid. See ‘man 2 setuid’ for more information.

Parameters:uid (uid_t) – uid
pwnlib.shellcraft.i386.linux.sh()[source]

Execute a different process.

>>> p = run_assembly(shellcraft.i386.linux.sh())
>>> p.sendline('echo Hello')
>>> p.recv()
'Hello\n'
pwnlib.shellcraft.i386.linux.sigaction(sig, act, oact)[source]

Invokes the syscall sigaction. See ‘man 2 sigaction’ for more information.

Parameters:
pwnlib.shellcraft.i386.linux.sigaltstack(ss, oss)[source]

Invokes the syscall sigaltstack. See ‘man 2 sigaltstack’ for more information.

Parameters:
pwnlib.shellcraft.i386.linux.signal(sig, handler)[source]

Invokes the syscall signal. See ‘man 2 signal’ for more information.

Parameters:
  • sig (int) – sig
  • handler (sighandler_t) – handler
pwnlib.shellcraft.i386.linux.sigpending(set)[source]

Invokes the syscall sigpending. See ‘man 2 sigpending’ for more information.

Parameters:set (sigset_t) – set
pwnlib.shellcraft.i386.linux.sigprocmask(how, set, oset)[source]

Invokes the syscall sigprocmask. See ‘man 2 sigprocmask’ for more information.

Parameters:
  • how (int) – how
  • set (sigset_t) – set
  • oset (sigset_t) – oset
pwnlib.shellcraft.i386.linux.sigreturn()[source]

Invokes the syscall sigreturn. See ‘man 2 sigreturn’ for more information.

pwnlib.shellcraft.i386.linux.sigsuspend(set)[source]

Invokes the syscall sigsuspend. See ‘man 2 sigsuspend’ for more information.

Parameters:set (sigset_t) – set
pwnlib.shellcraft.i386.linux.socket(network='ipv4', proto='tcp')[source]

Creates a new socket

Parameters:
  • network (str) – ipv4 or ipv6
  • proto (str) – tcp or udp
pwnlib.shellcraft.i386.linux.socketcall(socketcall, socket, sockaddr, sockaddr_len)[source]

Invokes a socket call (e.g. socket, send, recv, shutdown)

pwnlib.shellcraft.i386.linux.splice(fdin, offin, fdout, offout, length, flags)[source]

Invokes the syscall splice. See ‘man 2 splice’ for more information.

Parameters:
  • fdin (int) – fdin
  • offin (off64_t) – offin
  • fdout (int) – fdout
  • offout (off64_t) – offout
  • len (size_t) – len
  • flags (unsigned) – flags
pwnlib.shellcraft.i386.linux.stage(fd=0, length=None)[source]

Migrates shellcode to a new buffer.

Parameters:
  • fd (int) – Integer file descriptor to recv data from. Default is stdin (0).
  • length (int) – Optional buffer length. If None, the first pointer-width of data received is the length.

Example

>>> p = run_assembly(shellcraft.stage())
>>> sc = asm(shellcraft.echo("Hello\n", constants.STDOUT_FILENO))
>>> p.pack(len(sc))
>>> p.send(sc)
>>> p.recvline()
'Hello\n'
pwnlib.shellcraft.i386.linux.stager(sock, size, handle_error=False, tiny=False)[source]

Recives a fixed sized payload into a mmaped buffer Useful in conjuncion with findpeer. :param sock, the socket to read the payload from.: :param size, the size of the payload:

pwnlib.shellcraft.i386.linux.stat(file, buf)[source]

Invokes the syscall stat. See ‘man 2 stat’ for more information.

Parameters:
  • file (char) – file
  • buf (stat) – buf
pwnlib.shellcraft.i386.linux.stat64(file, buf)[source]

Invokes the syscall stat64. See ‘man 2 stat64’ for more information.

Parameters:
  • file (char) – file
  • buf (stat64) – buf
pwnlib.shellcraft.i386.linux.stime(when)[source]

Invokes the syscall stime. See ‘man 2 stime’ for more information.

Parameters:when (time_t) – when
pwnlib.shellcraft.i386.linux.stty(fd, params)[source]

Invokes the syscall stty. See ‘man 2 stty’ for more information.

Parameters:
  • fd (int) – fd
  • params (sgttyb) – params

Invokes the syscall symlink. See ‘man 2 symlink’ for more information.

Parameters:
  • from (char) – from
  • to (char) – to
pwnlib.shellcraft.i386.linux.symlinkat(from_, tofd, to)[source]

Invokes the syscall symlinkat. See ‘man 2 symlinkat’ for more information.

Parameters:
  • from (char) – from
  • tofd (int) – tofd
  • to (char) – to
pwnlib.shellcraft.i386.linux.sync()[source]

Invokes the syscall sync. See ‘man 2 sync’ for more information.

Arguments:

pwnlib.shellcraft.i386.linux.sync_file_range(fd, offset, count, flags)[source]

Invokes the syscall sync_file_range. See ‘man 2 sync_file_range’ for more information.

Parameters:
  • fd (int) – fd
  • offset (off64_t) – offset
  • count (off64_t) – count
  • flags (unsigned) – flags
pwnlib.shellcraft.i386.linux.syscall(syscall=None, arg0=None, arg1=None, arg2=None, arg3=None, arg4=None, arg5=None)[source]
Args: [syscall_number, *args]
Does a syscall

Any of the arguments can be expressions to be evaluated by pwnlib.constants.eval().

Example

>>> print pwnlib.shellcraft.i386.linux.syscall('SYS_execve', 1, 'esp', 2, 0).rstrip()
    /* call execve(1, 'esp', 2, 0) */
    push (SYS_execve) /* 0xb */
    pop eax
    push 1
    pop ebx
    mov ecx, esp
    push 2
    pop edx
    xor esi, esi
    int 0x80
>>> print pwnlib.shellcraft.i386.linux.syscall('SYS_execve', 2, 1, 0, 20).rstrip()
    /* call execve(2, 1, 0, 0x14) */
    push (SYS_execve) /* 0xb */
    pop eax
    push 2
    pop ebx
    push 1
    pop ecx
    push 0x14
    pop esi
    cdq /* edx=0 */
    int 0x80
>>> print pwnlib.shellcraft.i386.linux.syscall().rstrip()
    /* call syscall() */
    int 0x80
>>> print pwnlib.shellcraft.i386.linux.syscall('eax', 'ebx', 'ecx').rstrip()
    /* call syscall('eax', 'ebx', 'ecx') */
    /* setregs noop */
    int 0x80
>>> print pwnlib.shellcraft.i386.linux.syscall('ebp', None, None, 1).rstrip()
    /* call syscall('ebp', ?, ?, 1) */
    mov eax, ebp
    push 1
    pop edx
    int 0x80
>>> print pwnlib.shellcraft.i386.linux.syscall(
...               'SYS_mmap2', 0, 0x1000,
...               'PROT_READ | PROT_WRITE | PROT_EXEC',
...               'MAP_PRIVATE | MAP_ANONYMOUS',
...               -1, 0).rstrip()
    /* call mmap2(0, 0x1000, 'PROT_READ | PROT_WRITE | PROT_EXEC', 'MAP_PRIVATE | MAP_ANONYMOUS', -1, 0) */
    xor eax, eax
    mov al, 0xc0
    xor ebp, ebp
    xor ebx, ebx
    xor ecx, ecx
    mov ch, 0x1000 >> 8
    push -1
    pop edi
    push (PROT_READ | PROT_WRITE | PROT_EXEC) /* 7 */
    pop edx
    push (MAP_PRIVATE | MAP_ANONYMOUS) /* 0x22 */
    pop esi
    int 0x80
pwnlib.shellcraft.i386.linux.syslog(pri, fmt, vararg)[source]

Invokes the syscall syslog. See ‘man 2 syslog’ for more information.

Parameters:
  • pri (int) – pri
  • fmt (char) – fmt
  • vararg (int) – vararg
pwnlib.shellcraft.i386.linux.tee(fdin, fdout, length, flags)[source]

Invokes the syscall tee. See ‘man 2 tee’ for more information.

Parameters:
  • fdin (int) – fdin
  • fdout (int) – fdout
  • len (size_t) – len
  • flags (unsigned) – flags
pwnlib.shellcraft.i386.linux.time(timer)[source]

Invokes the syscall time. See ‘man 2 time’ for more information.

Parameters:timer (time_t) – timer
pwnlib.shellcraft.i386.linux.timer_create(clock_id, evp, timerid)[source]

Invokes the syscall timer_create. See ‘man 2 timer_create’ for more information.

Parameters:
  • clock_id (clockid_t) – clock_id
  • evp (sigevent) – evp
  • timerid (timer_t) – timerid
pwnlib.shellcraft.i386.linux.timer_delete(timerid)[source]

Invokes the syscall timer_delete. See ‘man 2 timer_delete’ for more information.

Parameters:timerid (timer_t) – timerid
pwnlib.shellcraft.i386.linux.timer_getoverrun(timerid)[source]

Invokes the syscall timer_getoverrun. See ‘man 2 timer_getoverrun’ for more information.

Parameters:timerid (timer_t) – timerid
pwnlib.shellcraft.i386.linux.timer_gettime(timerid, value)[source]

Invokes the syscall timer_gettime. See ‘man 2 timer_gettime’ for more information.

Parameters:
  • timerid (timer_t) – timerid
  • value (itimerspec) – value
pwnlib.shellcraft.i386.linux.timer_settime(timerid, flags, value, ovalue)[source]

Invokes the syscall timer_settime. See ‘man 2 timer_settime’ for more information.

Parameters:
  • timerid (timer_t) – timerid
  • flags (int) – flags
  • value (itimerspec) – value
  • ovalue (itimerspec) – ovalue
pwnlib.shellcraft.i386.linux.truncate(file, length)[source]

Invokes the syscall truncate. See ‘man 2 truncate’ for more information.

Parameters:
  • file (char) – file
  • length (off_t) – length
pwnlib.shellcraft.i386.linux.truncate64(file, length)[source]

Invokes the syscall truncate64. See ‘man 2 truncate64’ for more information.

Parameters:
  • file (char) – file
  • length (off64_t) – length
pwnlib.shellcraft.i386.linux.ulimit(cmd, vararg)[source]

Invokes the syscall ulimit. See ‘man 2 ulimit’ for more information.

Parameters:
  • cmd (int) – cmd
  • vararg (int) – vararg
pwnlib.shellcraft.i386.linux.umask(mask)[source]

Invokes the syscall umask. See ‘man 2 umask’ for more information.

Parameters:mask (mode_t) – mask
pwnlib.shellcraft.i386.linux.uname(name)[source]

Invokes the syscall uname. See ‘man 2 uname’ for more information.

Parameters:name (utsname) – name

Invokes the syscall unlink. See ‘man 2 unlink’ for more information.

Parameters:name (char) – name
pwnlib.shellcraft.i386.linux.unlinkat(fd, name, flag)[source]

Invokes the syscall unlinkat. See ‘man 2 unlinkat’ for more information.

Parameters:
  • fd (int) – fd
  • name (char) – name
  • flag (int) – flag
pwnlib.shellcraft.i386.linux.unshare(flags)[source]

Invokes the syscall unshare. See ‘man 2 unshare’ for more information.

Parameters:flags (int) – flags
pwnlib.shellcraft.i386.linux.ustat(dev, ubuf)[source]

Invokes the syscall ustat. See ‘man 2 ustat’ for more information.

Parameters:
  • dev (dev_t) – dev
  • ubuf (ustat) – ubuf
pwnlib.shellcraft.i386.linux.utime(file, file_times)[source]

Invokes the syscall utime. See ‘man 2 utime’ for more information.

Parameters:
  • file (char) – file
  • file_times (utimbuf) – file_times
pwnlib.shellcraft.i386.linux.utimensat(fd, path, times, flags)[source]

Invokes the syscall utimensat. See ‘man 2 utimensat’ for more information.

Parameters:
  • fd (int) – fd
  • path (char) – path
  • times (timespec) – times
  • flags (int) – flags
pwnlib.shellcraft.i386.linux.utimes(file, tvp)[source]

Invokes the syscall utimes. See ‘man 2 utimes’ for more information.

Parameters:
  • file (char) – file
  • tvp (timeval) – tvp
pwnlib.shellcraft.i386.linux.vfork()[source]

Invokes the syscall vfork. See ‘man 2 vfork’ for more information.

Arguments:

pwnlib.shellcraft.i386.linux.vhangup()[source]

Invokes the syscall vhangup. See ‘man 2 vhangup’ for more information.

Arguments:

pwnlib.shellcraft.i386.linux.vmsplice(fdout, iov, count, flags)[source]

Invokes the syscall vmsplice. See ‘man 2 vmsplice’ for more information.

Parameters:
  • fdout (int) – fdout
  • iov (iovec) – iov
  • count (size_t) – count
  • flags (unsigned) – flags
pwnlib.shellcraft.i386.linux.wait4(pid, stat_loc, options, usage)[source]

Invokes the syscall wait4. See ‘man 2 wait4’ for more information.

Parameters:
  • pid (pid_t) – pid
  • stat_loc (WAIT_STATUS) – stat_loc
  • options (int) – options
  • usage (rusage) – usage
pwnlib.shellcraft.i386.linux.waitid(idtype, id, infop, options)[source]

Invokes the syscall waitid. See ‘man 2 waitid’ for more information.

Parameters:
  • idtype (idtype_t) – idtype
  • id (id_t) – id
  • infop (siginfo_t) – infop
  • options (int) – options
pwnlib.shellcraft.i386.linux.waitpid(pid, stat_loc, options)[source]

Invokes the syscall waitpid. See ‘man 2 waitpid’ for more information.

Parameters:
  • pid (pid_t) – pid
  • stat_loc (int) – stat_loc
  • options (int) – options
pwnlib.shellcraft.i386.linux.write(fd, buf, n)[source]

Invokes the syscall write. See ‘man 2 write’ for more information.

Parameters:
  • fd (int) – fd
  • buf (void) – buf
  • n (size_t) – n
pwnlib.shellcraft.i386.linux.writev(fd, iovec, count)[source]

Invokes the syscall writev. See ‘man 2 writev’ for more information.

Parameters:
  • fd (int) – fd
  • iovec (iovec) – iovec
  • count (int) – count

pwnlib.shellcraft.i386.freebsd

Shellcraft module containing Intel i386 shellcodes for FreeBSD.

pwnlib.shellcraft.i386.freebsd.acceptloop_ipv4(port)[source]

Args: port Waits for a connection. Leaves socket in EBP. ipv4 only

pwnlib.shellcraft.i386.freebsd.i386_to_amd64()[source]

Returns code to switch from i386 to amd64 mode.

pwnlib.shellcraft.i386.freebsd.mov(dest, src, stack_allowed=True)[source]

Thin wrapper around pwnlib.shellcraft.i386.mov(), which sets context.os to ‘freebsd’ before calling.

Example

>>> print pwnlib.shellcraft.i386.freebsd.mov('eax', 'SYS_execve').rstrip()
    push (SYS_execve) /* 0x3b */
    pop eax
pwnlib.shellcraft.i386.freebsd.push(value)[source]

Thin wrapper around pwnlib.shellcraft.i386.push(), which sets context.os to ‘freebsd’ before calling.

Example

>>> print pwnlib.shellcraft.i386.freebsd.push('SYS_execve').rstrip()
    /* push (SYS_execve) (0x3b) */
    push 0x3b
pwnlib.shellcraft.i386.freebsd.sh()[source]

Execute /bin/sh